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Abstract. In classical Arthur-Merlin games, the class of languages whose 
membership proofs can be verified by Arthur using logarithmic space 
(AM(log-space)) coincides with the class P [Con89| . In this note, we show 
that if Arthur has a fixed-size quantum register (the size of the register 
does not depend on the length of the input) instead of another source 
of random bits, membership in any language in NP can be verified with 
any desired error bound. 



In a public-coin interactive proof system, a resource-bounded verifier 
(Arthur) checks proofs presented to it in a sequence of messages by an 
all-powerful prover (Merlin), from which Arthur can hide no information. 
Arthur is supposed to accept all and only the correct proofs with high 
probability. Quantum versions of these systems, where the verifier is a 
quantum computer, and the messages consist of quantum bits, have also 
been examined, with the most general variant with polynomial bounds 
on the exchanged messages and the verifier runtime shown to be equiv- 
alent in computational power to the classical version |MW05| . More re- 
stricted scenarios have also been examined; for instance, the class QCMA 
|AN02IAK06] corresponds to single- message quantum Arthur- Merlin games, 
where the proof is a classical string^ 

In this paper, we restrict this model further, by imposing a logarithmic 
space bound on the verifier, so that Arthur cannot even hold the entire 
proof string in memory, and take most of his "quantumness" away, by 
limiting him to use a quantum register (with a state set of size just three) 
as his only source of randomness. Without that small register, Arthur is 
a deterministic logspace machine, and the class of languages that it can 
verify membership in is just NL. In the version where Arthur is allowed to 
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use a classical random number generator, this class is known to equal P 
|Con89j . We will show that our version of Arthur with the small quantum 
register can verify membership in every language in NP. 

We use the abbreviation qTM, with a lowercase q, for the quantum 
Turing machine model with which we represent the verifier, to stress that 
it uses only a fixed number of quantum bits. The classical state set of 
Arthur is partitioned to three subsets, the reading states, communication 
states, and halting states. Every computational step of the qTM consists 
of two stages: 1) A selective quantum operation depending on the current 
classical state is performed on the quantum register, and 2) A determinis- 
tic transition updates the classical state, worktape content, and tape head 
positions depending on the current classical state s, the currently scanned 
tape symbols, the outcome of the quantum operation in the first stage, 
and, if s is a communication state, the next proof symbol transmitted by 
MerlinJl 

Merlin is assumed to learn the outcomes of the quantum operations 
performed by Arthur simultaneously with Arthur. Since these operations 
are the only source of randomness for Arthur, Merlin has complete infor- 
mation about Arthur's overall state at all times. 

Let q AM (log-space) be the class of languages that can be proven with 
bounded error to such verifiers that are restricted to use O(logn) space 
on their classical work tape for an input string of length n. We prove that 
NP C qAM (log-space) as follows: 

The well-known NP-complete language SUBSET-SUM is the collec- 
tion of all strings of the form S^a\^ . . . #a n # such that S and the a^s 
are numbers in binary (1 < i < n), and there exists a set / C {1, . . . , n} 
satisfying X^ie/ a * = where n > 0. For any language L € NP, Arthur 
repeatedly computes the logspace reduction from L to SUBSET-SUM in 
an infinite loop, and Merlin indicates which of the a^s are the members 
of /. During each iteration of this loop, Arthur restarts this process with 
a probability close to 1. With a great portion of the remaining (expo- 
nentially small) probability, Arthur subtracts the numbers indicated by 
Merlin from S, using his quantum register, as will be described below, and 
rejects if £^ i6 j a i ^ With the remaining (even smaller) probability, he 
accepts the proof. 

In a recent paper [YSlOj . Yakaryilmaz and Say showed that real-time 
quantum finite automata (qfa's) can perform low-probability arithmetic 

2 The knowledgeable reader will have noticed that this model is an intermediate be- 
tween 2-way finite automata with quantum and classical states |AW02| and the 
Turing machines with both classical and quantum tapes of |Wat03| . 



calculations as the one described above. Arthur uses its quantum register 
to implement the corresponding qfa, which it repeatedly feeds with the 
corresponding substrings of the output of the reduction it is computing. 

Membership in L can be proven to the resulting verifier with one-sided 
error in exponential expected time. In our detailed report, we show how 
to tune the amplitudes of the quantum transitions to achieve the desired 
error bound. 



Background 

A random number generator can be viewed as a system that consists of 
an n-state probabilistic register with state set Q = {qi \ 1 < i < n}, 
on which some stochastic operations (matrices) are applied, where n > 0. 
The distribution of the states of the register is represented by a stochastic 
column vector v. After applying a stochastic operator A on v, observation 
of the register to learn the index of its current state yields the outcome 
with probability pi = v'[i], where v' = Av. 

A quantum register (or any finite-dimensional quantum system) is an 
n-dimensional Hilbert space, a complex vector space with inner product, 
denoted as H n , where n > 0. The set B n = {\qi) | 1 < i < n} is an 
orthonormal basis for T~L n , where the i th entry of \qi) is 1 and the remaining 
entries are zeros. Any quantum state of the system is described by its 
state vector, say \tp), that is a linear combination of basis stated \ip) = 
a i + • • • + Oi n \q n ), where the number ctj is the amplitude of |%), whose 
modulus squared (|ai| 2 ) gives the probability of being in state qi, and 
Yli l a «| 2 = 1 (1 — i — n )- When \ip) contains more than one basis state 
with nonzero amplitude, the system is said to be in a superposition (of 
the basis states). 

The most general operator applied to a quantum system is a super- 
operator, which generalizes unitary and stochastic operators and also in- 
cludes measurement. Formally, a superoperator £ is composed by a finite 
number of operation elements, £ = {E±, . . . , E^}, satisfying that 
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where k € Z + and the indices are the measurement outcomes. When 
£ is applied on a quantum system in state i.e. £(\ip}), we obtain 
the measurement outcome i with probability pi = (ipi\ipi), where \ipi) is 
calculated as = Ei\ip) and 1 < i < k. If the outcome i is observed 
(pi > 0), the new state of the system is obtained by normalizing \ipi), 

which is \ipi) = ^jt. 

Moreover, as a special operator, the quantum register can be initial- 
ized to a predefined quantum state. We call this operator as the initialize 
operator, denoted £ , which has only one outcome. 

In this paper, we assume that the entries of stochastic and quantum 
operators are defined by rational numbers. 

Definition of proof systems 

We give the definition of proof systems based on |Con93| . We call our 
new system q Arthur- Merlin, or shortly qAM. 

An AM (resp., a qAM) system consists of a prover Merlin and a verifier 
Arthur (resp., qArthur). Both Arthur and qArthur are resource-bounded 
Turing machines having a read-only input tape and a read/write work 
tape. Each tape head has a two-way access. As a source of branching, the 
Arthur has a random number generator and the qArthur has a (finite- 
size) quantum register instead. The states of both are partitioned into 
reading, communication, and halting (accepting or rejecting) states and 
both have a special communication cell that allows them to communicate 
with Merlin, where the capacity of the cell is finite. 

The one-step transitions of the verifiers can be described as follows. 

— When Arthur (resp., qArthur) is in a reading state: 

1. Arthur applies a stochastic operator on its random number gener- 
ator (resp., qArthur applies a quantum operator on its finite reg- 
ister) based on the state and the symbols under the tape heads. 
Then, the outcome is automatically written to communication cell. 

2. The verifier determines the next configuration of the verifier, based 
on the symbol under the tape heads, the state and the outcome. 

— When the verifier is in a communication state: 

1. The verifiers writes a symbol on the communication cell with re- 
spect to the current state. 

2. Then, in response, Merlin writes a symbol in the cell. 

3. Based on the state and the symbol written by Merlin, the verifier 
defines the next state of the verifier. 



Note that, the input is accepted or rejected when Arthur enters a accept- 
ing or rejecting states, respectively. 

For a given input w, the probability that (P, V) accepts (rejects) w is 
the cumulative accepting (rejecting) probabilities taken over all branches 
of the verifier. The prover-verifier pair (P, V) is an AM (or a qAM) proof 
system with error probability e < ^ if 

1. for all w € L, the probability that (P, V) accepts w is greated than 
l-e, 

2. for all w ^ L, and all provers P* , the probability that (P* , V) rejects 
w is greater than 1 — e. 

Notation 

AM (restriction) (or qAM (restriction)) is the class of languages which have a 
proof system such that Arthur (or qArthur) has the restrictions denoted 
by restriction. We use restrictions on work space and specifically focus 
on constant space (denoted 1) or logarithmic space (denoted log-space). 
Note that, any TM with constant space can be converted to a finite state 
automaton. So the verifier becomes a (two-way) finite state automaton. 
Note that, Arthur (resp., qArthur) becomes a two-way probabilistic finite 
automaton, 2pfa, |Fre81] (resp., a two-way finite automaton with quantum 
and classical states, 2qcfa, |AW02)YS11| ) if we remove the communication 
part. 

SUBSET-SUM £ qAM(l) 

We present a qAM(l) proof system for the NP-complete language SUBSET- 
SUM, where qArthur is restricted with constant space. 

SUBSET-SUM is the collection of all strings of the form S^a\^ . . . #a n # 
such that S and the Oj's are numbers in binary (1 < i < n), and there 
exists a set I C {1, . . . , n} satisfying Yliel °* = ^> wri ere n > 0. 

At the beginning of the computation, the input is deterministically 
checked to see if it is of the form 

({0,l}+#) ({0,l}+#) + . 

If not, it is rejected. In the remaining part, we assume the input to be of 
the form 

5#ai#... #a n #, 
where S, the a^'s are numbers in binary (1 < i < n), and n > 0. 



The main idea is that qArthur scans the input from left to right in 
an infinite loop and firstly encodes S, and then subtracts the encoding 
of each of the cij's selected by Merlin, in some amplitudes of the classical 
states on the quantum register. And at the end of the loop, qArthur tests 
whether the result is zero or not as described later. Since our encoding 
procedure works by reducing the amplitude with a constant in each step, 
the process can successfully be ended with a exponentially small probabil- 
ity depending on the length of the input. Therefore, the loop is repeated 
with high probability. The technical details are given below. 

The register has 3 classical states, i.e. {91,92,93}- We can divide the 
procedure into 5 parts. The input head is moved right whenever the out- 
come "— )>" is observed. If the outcome "A" or "R" is observed, the input is 
accepted or rejected, respectively. Otherwise, the procedure is restarted. 

1. The finite register is initialized on symbol (fc: 



1-00 



2. The first binary integer (S) is encoded into the amplitudes of I92}: £ a 
is applied on the quantum register when reading a £ {0, 1}, i.e. 
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£# is applied on the quantum register when reading i.e. 



1 2_ 2^ 
-1 ; -I; -1 

3 ^ 



3. Each aj (1 < i < n) is encoded into the amplitude of \qs): £' a is applied 
on the quantum register when reading a € {0, 1}, i.e. 
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4. If an cti (1 < i < n) is selected on Merlin's advice received on symbol 
it is subtracted from the number represented by the amplitude of 
qi : is applied on the quantum register, i.e. 
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If it is not selected, £"# is applied on the quantum register, i.e. 
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Note that, the amplitude of \qs) is set to after each of these trans- 
formations. 

5. The decision is given on $: is applied on the quantum register when 
reading $, i.e. 
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Let w be the input. Then, the state of quantum register before reading $ 



is 




where T is the cumulative sum of selected ctj's by Merlin. After applying 
£$, the input is rejected with probability 

1 \ 2\w\+2 

(35 - 3T) 2 , 



which is at least 9 (I^ 2 '*"' -1-2 [f S ^ T and is exactly equal to if S = 

T. On the other hand, it is always accepted with probability (|) 2 ' u '' +2 . 
Therefore, if the input is a member of SUBSET-SUM, there exists a 
Merlin such that it is accepted exactly. On the other hand, if the input 
is not a member of SUBSET-SUM, whatevet Merlin says, it is rejected 
with a probability at least The error bound can be reduced easily by 
using conventional probability amplification techniques. 



NP C qAM(log-space) 

Since any language L G NP is log-space reducible |Pap94| to SUBSET- 
SUM, we conclude that Arthur can verify membership in any such L with 
high probability of correctness using only logarithmic (classical) space, 
and a fixed-size quantum register to implement the qfa described above. 
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